🔑 Gone in Under a Minute, No Key Required
Two guys walk up to a car parked on a dark street. One stands near the house holding something the size of a small radio. The other stands next to the car holding something almost identical. Thirty seconds later, the doors unlock, the engine starts, and the car pulls away. Nobody touched a window. Nobody broke anything. Nobody even needed the key, which was sitting on a table by the front door the whole time.
That's a relay attack, and it's the reason keyless entry, the feature every car guy used to brag about, turned into the thing that keeps owners of certain cars checking their driveway twice before bed. Doorbell camera footage of these thefts has been circulating for years now, and it's genuinely unsettling to watch how fast and how quiet the whole thing is.
Car people argue about a lot of theoretical stuff: whether turbo lag still matters, whether manuals are actually dying, whether your build is objectively cooler than the next guy's. This isn't theoretical. If you own anything with proximity keyless entry built in the last fifteen years, this is a real threat model for your actual car, sitting in your actual driveway tonight.
📡 How the Attack Actually Works
Keyless entry systems work on a simple handshake. Your key fob is constantly listening for a low-power signal from the car. When you walk close enough, the car's signal reaches the fob, the fob replies with its own encrypted code, and the car unlocks and lets you push the start button. The whole exchange is designed to only work over a few feet, specifically so a key sitting in your pocket across a parking lot can't accidentally start a stranger's car.
That short range is the entire security model, and it's also the entire flaw. A relay attack doesn't crack any encryption or guess any code. It just extends the distance. One device (the "relay") is held near the house, close enough to pick up the fob's faint always-on signal even through a wall or window. It repeats that signal, essentially over a mini radio bridge, to a second device sitting next to the car. As far as the car is concerned, the real fob is standing right next to it, because the signal that arrives is identical. The car unlocks, the ignition starts, and the thief drives off in under a minute in a lot of documented cases.
None of this requires exotic hacking skill anymore. Relay devices have gotten cheap and small enough that they're sold (often thinly disguised as "diagnostic" or "signal repeater" tools) to anyone willing to pay for one online, and tutorials for building a basic setup have circulated on forums and video platforms for years. What used to require real technical know-how is now closer to plug-and-play, which is exactly why the theft numbers climbed as fast as they did once keyless entry became standard equipment across most trim levels instead of an option on flagship models.
Spota tip: this is the same instinct that makes a good Photo Op location pick matter. Where you park isn't just about getting a clean shot, it's about not making your car the easiest target on the block.
🎯 Why Some Cars Get Hit Constantly and Others Barely at All
Ask any insurance adjuster which cars top the keyless theft list and you'll hear the same handful of names over and over: high-trim SUVs, especially from brands like Land Rover and Range Rover, along with a rotating cast of luxury sedans and performance trims that share three things in common.
High resale value for parts, not just the whole car. A stolen Range Rover doesn't need to be resold intact to be profitable. Entire theft rings exist purely to strip a vehicle for parts (infotainment units, badges, doors, engines) and move them through parts networks faster than police can track a VIN. The higher the parts value, the more worth the risk.
Consistent keyless architecture across model years. Once a theft ring figures out how a specific automaker's proximity system responds to a relay attack, that knowledge works across an entire model range and multiple years, sometimes a full console generation. That's why certain models get hit in waves specific to a manufacturer's keyless rollout, then taper off once that automaker finally patches the vulnerability in a later refresh.
Where they're parked. Cars parked on the street or in open driveways where a relay device can pick up the fob's signal through a wall are far easier targets than cars locked in an attached garage with the fob stored somewhere in the middle of the house. Distance and physical barriers both weaken the signal a relay device needs to catch.
What almost never gets hit this way: older cars with traditional physical keys and no proximity system at all, ironically making a beat-up early-2000s daily driver one of the least relay-attackable vehicles on the road, and newer vehicles running the latest secure ranging technology, which is a genuinely different animal from the systems that got exploited for most of the last decade.
🛡️ What Actually Stops It
Car forums and social media are full of anti-theft advice, and just like with catalytic converter theft, some of it works and some of it is closer to folklore. Here's what's actually backed by real testing and what security researchers and insurers consistently point to.
Faraday pouches and boxes. A Faraday pouch blocks radio signals entirely, meaning a fob stored inside one can't be picked up by a relay device no matter how close it gets. This is the single most effective, cheapest fix that exists, and it costs less than a car wash. The catch: it only works if you actually use it every single time, and a cheap, poorly-shielded pouch can degrade over time and stop blocking signal as effectively as it did new.
Storing the fob away from exterior walls and windows. Distance is your friend here. A fob sitting in a kitchen drawer on the far side of the house is a much harder target than one sitting in a bowl by the front door, which is often exactly where the relay attack starts.
Disabling the fob's proximity sleep function, where the car allows it. Some manufacturers added a setting or built a fob feature that lets the key "sleep," meaning it stops broadcasting its signal until physically touched or a button is pressed. If your fob supports this, using it every night is close to as effective as a Faraday pouch and takes zero extra steps once it's habit.
A visible, mechanical steering wheel lock. This sounds almost too basic for a modern theft problem, but it works precisely because it's not electronic. A relay attack gets a thief into the car and gets it started, but it does nothing against a steel bar locked across the wheel. Thieves working fast, quiet jobs on a schedule will often just move to the next car rather than spend extra minutes defeating a physical lock in the open.
Aftermarket immobilizers and OBD port locks. Because a lot of relay-attack thefts pair with a secondary trick where thieves plug into the OBD-II port to program a blank key once they're inside, a physical lock over that port, or a hidden kill switch wired into the ignition circuit, adds a real second layer that a purely electronic relay attack can't bypass on its own.
🎭 What's Mostly Theater
Wrapping the fob in tinfoil. It sounds like the same idea as a Faraday pouch and technically shares the same principle, but household foil is inconsistent, tears easily, and rarely provides full, reliable shielding compared to a purpose-built pouch. It's a start, not a solution.
Basic factory alarms. Most stock alarm systems are built to detect a door opening or glass breaking, not a key fob signal being relayed. Since the car thinks the real key is present the entire time, a standard alarm often never triggers at all during a relay attack, because as far as the car's computer is concerned, nothing unauthorized happened.
Assuming an expensive car means better protection. Ironically, some of the priciest models on the road have historically been some of the easiest relay-attack targets, precisely because they were among the first to roll out keyless proximity entry as a headline luxury feature, years before the security model caught up to the threat.
💸 The Insurance Fallout Nobody Budgets For
Getting relay-attacked isn't just a missing car, it's a paperwork problem that drags on for weeks. Comprehensive coverage typically pays out for theft, but plenty of owners running liability-only policies (common once a car's a few years old and paid off) find out the hard way that they're not covered for a total loss they never saw coming.
Even with full coverage, insurers in high-theft areas have started treating keyless models differently. Some have raised premiums specifically on the makes and models that show up most often in theft claims, and a few now ask directly whether the owner uses a Faraday pouch or has a steering lock installed before finalizing a policy on certain trims. It's the same logic that pushed some insurers to discount premiums for catalytic converter shields: cheap, provable anti-theft measures start showing up as real underwriting questions once a theft category gets big enough to move the actuarial tables.
There's also a recovery gap worth knowing about. Because relay-attack thefts don't trip an alarm or leave forced-entry damage, a stolen car can be gone for hours before anyone even notices it's missing, compared to a smashed window that gets spotted fast. That head start matters. GPS trackers, whether factory-installed telematics or an aftermarket unit wired in separately from the main electrical system, have become one of the more common recommendations from insurers specifically because they shrink that window and give police an actual location to chase instead of a cold trail.
📶 Where This Is Actually Headed
The good news is that the industry didn't just shrug this off. A newer short-range radio technology called ultra-wideband, often shortened to UWB, is increasingly showing up in flagship and mid-tier vehicles as the real fix, not just a patch. Unlike the older systems that relay attacks exploit, UWB can measure the precise time it takes a signal to travel between the fob and the car down to fractions of a nanosecond, which lets it calculate real physical distance instead of just detecting whether a signal is present. A relayed signal takes measurably longer to travel than a genuine close-range one, and that timing gap is exactly what UWB is built to catch. Multiple automakers and phone makers have been aligning around shared UWB standards specifically so this kind of secure ranging becomes the default instead of a premium option buried in a options package.
None of that helps the millions of vehicles already on the road running older keyless systems, which is why the aftermarket fixes above still matter and will keep mattering for years. Car culture has a long memory for exactly this kind of thing: the same way enthusiasts still talk about the catalytic converter theft wave years after it peaked, keyless relay theft is shaping up to be a multi-year story that outlives whatever headline coverage it gets this year.
❓ Quick Answers
Can a relay attack work through my house walls? Yes, in a lot of cases. A fob's always-on signal is weak, but modern relay devices are sensitive enough to pick it up through drywall, wood, and glass. Distance from the exterior wall matters more than the wall material itself.
Does a Faraday pouch actually block the signal, or is that a myth? It's real, and it's the most effective single fix available for older keyless systems. The catch is consistency: it only works if the fob is inside it every time the car is parked, and a cheap or worn-out pouch can lose its shielding effectiveness over time.
Will my car's factory alarm go off during a relay attack? Usually not. Because the car's computer believes the real key is present the whole time, most standard alarms never trigger. That's exactly why physical deterrents like a steering lock matter so much here.
Is this only a problem for luxury or high-trim SUVs? No, but they get hit disproportionately because of resale and parts value. Any vehicle with proximity keyless entry is technically vulnerable to the same core attack, it's just a matter of which targets are most profitable for a theft ring to prioritize.
Does turning off Bluetooth or Wi-Fi on my phone help? Not for this specific attack. Relay theft targets the physical key fob's short-range radio signal, not a phone or app-based digital key. Phone-based digital key systems have their own separate security model entirely.
🚗 The Real Takeaway
Keyless entry wasn't a bad idea. It's genuinely one of the more convenient pieces of tech to land in cars in the last twenty years, and nobody's arguing for a return to fumbling with a physical key in the rain. But convenience and security are constantly trading places in this industry, and relay attack theft is what happens when convenience gets a fifteen-year head start on the fix.
If there's one thing worth taking from this: the cheapest, most boring defenses (a Faraday pouch, a steering lock, storing your fob away from the front door) are also the most effective ones. No amount of horsepower or curb appeal matters if the car's gone by the time you wake up.
For more on the unglamorous side of car ownership that actually protects what you've built, check out Maintenance Mistakes That Kill Cars Slowly, or browse more culture and ownership deep-dives over in Under the Hood.
Lock it, hide the fob, and sleep easy. Everything else about your build can wait until morning.
